In addition to the qualitative evaluation of the fidelity of synthetic images, we have also included the Learned Perceptual Image Patch Similarity (LPIPS) to quantitatively evaluate the them [1]}. LPIPS assesses the perceptual similarity between two pictures. In essence, LPIPS determines how comparable two picture patches' activations are for a given network. In our experiments, we use AlexNet as the neural network. This measurement has been demonstrated to closely reflect human perception [2]}. Image patches with a low LPIPS score are perceptually similar. We have also run the classification experiments in Section REF  to measure the influence of attack directly on training Deep Neural Networks.
